Max Isbey
59c066dfce
The README, the get-started docs, the What's new page, SECURITY.md, and the contributor docs all still described v2 as a pre-release: pin an exact 2.0.0b1, do not use in production, v1.x is the only stable line. This flips that framing for the stable release. Install lines become plain `mcp[cli]` (the launch-command page keeps only the exact pin that `mcp install` itself writes), the pre-release banners and pin warnings go away, the What's new page drops its beta note and the two stale "since 2.0.0bN" provenance markers, and SECURITY.md gains a supported-versions table (2.x current, 1.28.x maintenance). v1.x is presented as the maintenance line throughout, with its docs at /v1/ and a `<2` bound for projects that are not ready to migrate. The branching-model text in AGENTS.md and CONTRIBUTING.md now describes main as the stable line, and the v2 feedback issue template loses its pre-release wording and the v2-alpha label. No-Verification-Needed: doc-only
1.6 KiB
1.6 KiB
Security Policy
Thank you for helping keep the Model Context Protocol and its ecosystem secure.
Supported Versions
| Version | Line | Support |
|---|---|---|
| 2.x (newest release) | current stable (main) |
bug fixes, security fixes, new features |
1.28.x (v1.x branch) |
maintenance | critical bug fixes and security fixes |
| < 1.28, and all pre-release versions | unsupported | upgrade to the newest 1.28.x or to 2.x |
Only the newest release of a supported line receives fixes, so reproduce against
it before reporting. If your project depends on mcp and is not yet ready for
2.x, constrain to mcp>=1.28,<2 and follow the
migration guide when you
migrate.
Reporting Security Issues
If you discover a security vulnerability in this repository, please report it through the GitHub Security Advisory process for this repository.
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
What to Include
To help us triage and respond quickly, please include:
- A description of the vulnerability
- Steps to reproduce the issue
- The potential impact
- Any suggested fixes (optional)